Executive Insights for Implementing AI in Cybersecurity: From Risk to Force Multiplier 

Nick Viviano Schonfeld | Head of Cybersecurity

Viviano likened the current AI news cycle to a clay‑pigeon shooting range – new threats seem to launch from every direction, with recent incidents illustrating just how quickly AI can amplify risk:

• An autonomous agent on a prominent cloud computing platform incorrectly decided to delete and rebuild their technical environment, causing a 13‑hour outage. 
• A major consumer electronics company’s source‑code leak showed how an AI co‑pilot can unintentionally expose confidential code and meeting notes. 
• A misconfigured AI service at a leading consulting firm was breached, and a prompt injection allowed attackers to extract internal data. 

These examples demonstrate how even the world’s biggest tech firms struggle to keep AI under control.

From Data Loss To Prompt Injection

Early concerns around integrating AI have focused on preventing the exfiltration of sensitive information, leading companies to rush to build private LLMs and implement strict guardrails. However, the nature of that threat has evolved: malicious prompts can now coax AI into revealing backend credentials, system details or even trigger actions on the fly. Viviano also highlighted how the speed at which AI can generate and execute attacks outpaces traditional human‑centric defenses.

The Paradox of Automation

Security teams already chase speed through SOAR and automated playbooks. Adding non‑deterministic AI agents creates a new dilemma: how to automate without losing control. Sandboxing sounds ideal, but it often strips AI of the connectivity it needs to be useful, leaving teams to balance safety with business enablement.

Operational Resiliency Under Pressure

AI lowers the barrier to code creation – now even non‑technical staff can spin up applications that bypass traditional SDLC gates and land directly in production. Without observability, these shadow services can become blind spots for defenders and erode accountability if “the agent did it” becomes the default answer. To counter this, Viviano emphasized the need for executives to embed policies that assign clear human ownership to any AI‑generated artifact deployed. 

Hallucinations and Control Weaknesses

Hallucinated outputs pose a lingering cyber risk. AI that misinterprets log data or mislabels threat indicators can corrupt detection pipelines and waste analysts’ time by having them chase down false leads. Coupled with the rapid “patch‑fast‑risk” trade‑off—where aggressive updates can break systems not designed for quick patching—the overall risk surface expands dramatically.

Turning AI into a Force Multiplier

The danger may be significant, but the upside can be too – Viviano’s team at Schonfeld is piloting low‑risk, high‑reward AI use cases that aim to augment—not replace—human talent.

Start small, think big

Viviano argues that the implementation goal of AI should be simple: AI should free analysts to focus on the highest‑value work. Rather than automating entire detection cycles, AI can be used more impactfully to automate repetitive, knowledge‑intensive tasks such as query generation and report drafting.

Threat‑Hunting Assistant – A Concrete Example

The pilot consists of a private LLM with a front‑end UI that acts as a security co-pilot. Two narrowly scoped “skills” were built:

• Report‑writer ingests internal and public intel, then drafts a structured hunt plan and final report.
• SIEM‑query author learns the organization’s log taxonomy and query syntax, producing ready‑to‑run SIEM searches.

In practice, an analyst inputs a new attack scenario. The assistant instantly returns tailored SIEM queries, enabling the team to verify there is no active exploitation and generate a concise report—all within minutes. Tasks that previously consumed hours shrank to a few clicks, and junior analysts could now perform preliminary hunts while senior staff focused on deep investigations.

Rapid Implementation And ROI

Because the prototype merely copied queries into the SIEM, it was functional after one to two days of work. This “day‑zero” capability demonstrates that, with a private LLM and well‑defined skills, executives can achieve measurable ROI without a massive upfront investment of time or resources.

Human‑In‑The‑Loop Remains Essential

Viviano argues that deterministic automation should always be paired with human oversight. AI suggests, while the analyst validates – this maintains both speed and accuracy while preserving accountability.

Executive Takeaways

• AI‑induced outages – Conduct formal risk assessments of any autonomous AI agents that can modify infrastructure. Implement kill‑switches and maintain detailed audit trails.
• Prompt injection & data leakage – Harden LLM interfaces with strict input validation, limit exposure of internal knowledge bases and monitor for anomalous query patterns.
• Shadow IT via AI‑generated code – Extend SDLC controls to cover AI‑produced artifacts and deploy runtime security tools that detect unsanctioned services as soon as they appear in production.
• Accountability gaps – Codify policies that assign explicit human ownership to every AI‑generated deployment, regardless of the agent’s autonomy.
• Low‑risk pilot projects – Identify repetitive analyst tasks (query writing, report formatting) and build private LLM assistants with narrowly scoped skills. Measure time saved and quality improvements before scaling.
• Human‑in‑the‑loop governance – Establish clear escalation paths: AI suggests → Analyst reviews → Action taken. Document decisions to feed back into model training and policy refinement.

Looking Ahead

The AI debate is not a binary “risk vs. reward” narrative; it’s a continuum where control, speed and accountability intersect. As Viviano’s experience shows, the most effective programs treat AI as a force multiplier—a tool that accelerates the work of seasoned professionals while enhancing the overall security posture.

For cybersecurity executives, the mandate is clear:

1. Map where AI currently exists and what autonomous actions it can take.
2. Contain that power with sandboxing, strict access controls and auditability.
3. Leverage the same technology to automate low‑value tasks, freeing your talent for strategic threat hunting and response.

By confronting the risks head‑on and investing in well‑governed, low‑friction pilots, you can turn the AI wave from a looming threat into a decisive competitive advantage. Your organization’s next steps will determine whether AI becomes a risk multiplier or a force multiplier for your security program.